iw5: add MP console overlay (TU24)

[elliot1377]

IW5 MP (TU24): console overlay

Retail MW3 has the interactive console compiled out, so the IW4 MP TU6 approach (calling Con_ToggleConsole etc.) can't be ported:

• no toggleconsole string/command, no console colour dvars, no dvar-protection messages
• monkeytoy is registered but never read; the console input field is initialised but never used
• cls.consoleMaterial is loaded but never drawn

This adds a small overlay module instead (src/game/iw5/mp/console.cpp):

• keyboard via XInputGetKeystroke(0, XINPUT_FLAG_KEYBOARD, ...), same as the IW3/IW4/T4 consoles
• ` / ~ toggles, Enter runs the line through Cbuf_AddText, Backspace, Esc closes, PgUp/PgDn scroll
• output captured from CL_ConsolePrint into a ring buffer, drawn with UI_DrawText + sharedUiInfo->assets.consoleFont
• per-frame hook on the UI refresh, which runs in menus and in-game

New TU24 symbols

Symbol	Address	Notes
Cbuf_AddText(int localClientNum, const char *text)	0x82287F68	p0-p3 prefix parse
UI refresh void (LocalClientNum_t)	0x822F82E8	called from both frame draws (0x8217CB60 in-game, 0x8217CF90 menu); calls UI_DrawBuildNumber (0x822ECA88) only when disconnected with a menu open, which is why that hook can't be used in-game

How they were found: located in a TU0 IDB, then translated to TU24 against a memory dump of the running TU24 image using masked PPC signatures (branch targets and data-address immediates masked, unique matches only). Validated on existing CoD Xe TU24 symbols: 9/12 map exactly onto TU0 function starts (the 3 misses are functions CoD Xe detours). The UI refresh address is also confirmed by its call to the known UI_DrawBuildNumber at the same position as in TU0.

Other changes

• patches.cpp: removed the debug-only CL_ConsolePrint detour; the Console module owns it now and keeps the same DbgPrint in debug builds (avoids two detours on one function).
• codxe.vcxproj: added console.cpp.

Not tested

I don't have the Xbox 360 SDK, so this hasn't been compiled or run. If you can make a test build I'm happy to test it in Xenia on TU24 (keyboard passthrough, keyboard_mode = 2).